Crypto Fraud – what can be done to recover digital assets?

Here, Greg Pooler, partner and head of Sherrards’ Crypto Fraud unit, explains, in the context of the firm’s recent experience advising litigants in relation to such matters, what can be done to recover digital assets

Part 1: In the ₿eginning

This article is part of a two-part series that leverages this firm’s recent experience advising litigants in relation to claims involving the recovery of digital assets.  The first part looks at the initial stages of the dispute from the perspective of a commercial litigator and what is typically involved.  The second article will provide a more substantive examination of how the forensic tools available under English law have been deployed to recover digital assets.

A legal history: ultra abridged version

Such is the progressive and enlightened nature of English law that it is not necessary to first surmount the hurdle of establishing whether digital assets are property against which traditional asset recovery remedies can be deployed. That question has been answered in the affirmative in several lines of authority, buttressed more recently by the Property (Digital Assets etc) Act 2025 which confirms that something can attract property legal rights without necessarily falling into the two categories of traditional property choses in action and choses in possession.  For the uninitiated, a pithy summary of the position can be found in the decision of Bryan J in AA v Persons Unknown [2019] EWHC 3556 (Comm): “I consider that it is fallacious to proceed on the basis that the English law of property recognises no forms of property other than choses in possession and choses in action”. 

Crypto and the blockchain grotesquely oversimplified

Seeking simple answers to complex questions is very much on trend, so this article will attempt to start from first principles accompanied with a health warning that this is a very complex area.  There are many types of digital currencies each with their own properties.  For the purposes of this article we will assume we are dealing with BTC or Ethereum, these being the most mainstream forms of digital assets that together have a combined market capitalization of over USD 2 trillion.   

At the atomic level cryptocurrency is computer code, but the definition of “what” they are precisely is inseparable from the digital infrastructure in which they are nested. That infrastructure is (you might have guessed) the “blockchain”.  It is beyond the scope of this note to explain comprehensively what a “blockchain” is, but some basic working knowledge is helpful if you are confronted with a dispute in this domain.

If you want to anchor your understanding to something in the real world, you can (multiple sources tell me) think of the blockchain as a kind of publicly accessible community ledger (or “decentralized ledger” to adopt official nomenclature), consisting of “blocks” of information (written in computer code) that tells you who owns what.  This architecture has the following structural features:

1. It consists of a network of computers, with each computer constituting a “node” on the network which serves as the backbone of the blockchain.
2. Each node is a record of every transaction that has ever occurred on the blockchain. This is perhaps its defining feature that confers the property of “immutability” and why it is considered revolutionary: all the nodes must be in a state of agreement or “consensus” as to any given transaction when digital assets are transferred (literally “we all agree x has sent an amount y of say BTC to z and that this is a valid transaction”).  Each node is constantly communicating with all the others ensuring this consensus condition is preserved.  This consensus condition is the only way a transaction is permitted.  The reason why this is considered revolutionary is because it is a system that eliminates the problem of double counting that plague standard ledgers and leave them vulnerable to exploitation. 
3. These nodes also serve as the ramp on to the blockchain and are what the individual wallets interact with to send and receive cryptocurrency. The wallets are the interface with the blockchain with which consumers are most familiar.  Each wallet has an address associated with it which is public, meaning anyone can see how much cryptocurrency is contained within that wallet.  

Pausing there, it is important to appreciate the wallets are not the blockchain and it is important not to conflate the two. Indeed, it is a slightly misleading label because the wallet is not really where the digital asset is stored – the digital asset remains on the blockchain and the wallet performs a “broadcasting” function to communicate with the blockchain in relation to transactions.  For a commercial fraud lawyer however they are a fundamental part of the overall infrastructure and it is important to understand how they basically work:  

1. There are two pieces of information that are fundamental to being able to access the cryptocurrency within the wallet. These are, respectively, the “public” and “private” keys associated with that wallet which are sequences of letters and numbers. 

(a) The “private key” is what enables the wallet holder to access and send cryptocurrency from their wallet, they are functionally the keys to the safe and what determines control of the cryptocurrency. The private key is known only to the wallet holder and who has the private key tends to be the battleground for dispute purposes. 

(b) The “public key” on the other hand is what the cryptocurrency is tethered to, often it is described as being analogous to a bank account number in the sense that it is what is shared with others to enable cryptocurrency to be transferred from one wallet to another, but does not give you access to the account. Unlike an account number however, for some cryptocurrencies (like BTC) the public key is “effervescent” in the sense that it is randomly generated from the private key using sophisticated cryptography techniques for each transaction.

2. Another key thing to grasp is that wallets are either custodial or non-custodial. Custodial wallets are those that are typically held by a third party such as an exchange, the user interacts with their wallet through the exchange’s platform and it is the exchange who holds the public and private keys.  Non-custodial wallets describe the situation where the user themselves holds the private keys for example on a device like a USB stick or hardware drive.  If that non-custodial wallet is lost e.g. like hard drive is misplaced or destroyed there is no possibility of recovering the private key and the BTC is lost forever.

Bringing these features together to explain how a transaction works mechanically, when someone wants to send cryptocurrency on the network, they use their private key, to mathematically verify a message transmitted across the blockchain “move X BTC to address Y”, address Y being the public address of the transferee.  It is the public key that is central to the process, enabling the blockchain network to agree that the message “transfer X BTC” has come from the transferor’s wallet without revealing the wallet’s private key.  This validation on the blockchain network produces a transaction “hash” specific to that transaction (note this is just a transaction reference and does not encode information about the parties to the transaction). 

The process concludes by the cryptocurrency being untethered from the transferor’s private wallet and then tethered to the transferee’s private wallet. Health warning: this is a very oversimplified explanation of the process and is not of universal application to how cryptocurrencies work – as stated above there are different cryptocurrencies with different properties but this is broadly how bitcoin works.  What matters to litigators are the legal consequences of each step in terms of ownership, transfer and acquisition of title and what information is available to tell you what has happened in a given transaction.

Initiating the claim for the uninitiated

There is no one-size-fits-all methodology for onboarding a dispute where the exercise is the recovery of misappropriated digital assets.  What first steps are appropriate is a fact sensitive question and depends on the underlying nature of the fraud: the English courts have confronted many species of fraud involving cyber attacks, socially engineered frauds through to digital asset investment scams. 

Whatever the species of dispute, the first exercise will be data preservation and information harvesting from the digital ecosystem described above to facilitate the tracing exercise. Because of blockchain’s public accessibility, a lot of information can be obtained about the underlying transactions using the right tools.  Accordingly, typically the very first step will involve capturing as much forensic evidence as possible in order to construct a “digital paper trail” with reference to the following core bits of information:

• The first most basic question is how the wallet is held, e.g. through an exchange (the “custodial wallets” described above) or  in some other form, like a USB or hard drive (so called “non-custodial wallets”).
• You need to identify the specific transfers to the fraudster and the primary data point for that are the “transaction hashes” which should be compiled.
• The wallet addresses, both the address that the digital assets were sent to and the addresses they were sent from.
• Other common sense key transaction data points like the time of the transfers, exact amounts and asset types.

How this information, particularly the first two items, is compiled is situation dependent.  Most retail investors hold their digital assets on an exchange (and around a tenth of all BTC is said to be held on wallets on exchanges). Mainstream exchanges have their own methods for providing this information and generating documents for transactions which contain this “raw” blockchain data.  

These are the basic data points, but there are many more.  The priority will be to involve a forensic expert specializing in digital asset tracing exercises who can work with you and the client to identify further relevant information and data points to facilitate the tracing process. Welcome to the highly lucrative industry of chain-analysis service providers that has spawned its own lexicon to describe the analytical tools used in the analysis and the techniques employed by fraudsters.  In simple terms the task is to leverage the public nature of the blockchain to establish patterns that can reveal information about the wallets to which the digital assets have been transferred. 

As you traverse the terrain of a digital asset recovery exercise expect to encounter the following concepts:

• Hops: Following the movement of digital currency from one wallet to another. Sophisticated frauds can involve hundreds of hops.
• Clustering: Establishing whether wallets belong to the same owner, something that can be determined through some complex mathematics applied to the transaction data.
• Mixers: a diabolical device used by fraudsters to frustrate the tracing process by obscuring patterns in the data making it difficult to establish sender/recipient information.

Specialist blockchain analytics service providers have proprietary information which they map on to their analysis in order to identify wallet holders.  Again how this works is complex, but chain analysis enables for example information about certain wallets to be connected with certain exchanges.  Being able to associate a wallet with a third party like an exchange is a hugely valuable piece of information for the reasons explained below.  The end point in the exercise is to (ideally) assert with confidence “these addresses or cluster of addresses are associated with this wallet holder” or “these addresses are associated with this exchange”.

I’ve got some intel: what do I do next?

In our next article we will look at how this information has been combined with the English law asset recovery toolkit to successfully recover digital assets and what that process typically looks like and involves.  

For information about Sherrards’ Crypto, Blockchain and Digital Assets Recovery unit, please speak to Greg Pooler on Gregory.pooler@sherrards.com or Jan Kunstyr on jan.kunstyr@sherrards.com (T: +44 (0) 207 478 9010)